Transportation company's constant surveillance of drivers is more intrusive than necessary

PIPEDA Findings #2021-008

March 22, 2021

---

Complaint under the Personal Information Protection and Electronic Documents Act (the “Act”)

Report of findings

Complaint

1. The complainant, a truck driver, alleged that his employer, Oculus Transport Ltd. (“Oculus” or “the respondent”), an interprovincial trucking company operating in Alberta and British Columbia, collected his personal information for purposes that a reasonable person would not consider appropriate in the circumstances. Specifically, he alleged that the respondent collected audio recordings of all conversations that occurred within the cab of his truck, even while he was off-duty.
2. We examined whether the respondent collected and used the personal information of its drivers, like the complainant, via audio surveillance technology, for purposes that a reasonable person would consider appropriate in the circumstances.

Background

3. The respondent introduced surveillance devices into the cabs of its trucks from January 2017 onwards, primarily to aid incident investigations and liability apportionment, and ensure compliance with provincial regulations and road owners’ policies.
4. The device recorded audio within the cab (which would include the driver’s conversations), video (out the front window of the truck), and real-time location information of the Oculus truck. Our investigation is limited to the collection of audio information.
5. According to the complainant, a surveillance device was installed in his cab in March 2017. He claims that he initially thought the device was only a dashboard camera (capturing forward facing video), and that he did not know it recorded audio within the truck until conducting his own research.
6. The complainant removed the device from his cab. Oculus reprimanded him for doing so and ultimately, terminated his employment after he refused to agree to audio surveillance.
7. The respondent recently informed our Office that they were no longer using audio surveillance. They are now using forward facing cameras that do not record sound.

Analysis

Issue: Whether Oculus’s purposes for audio surveillance were appropriate

8. In our view, a reasonable person would not consider the purposes for which Oculus collected and used personal information from its drivers, via its surveillance technology, to be appropriate in the circumstances^{Footnote 1}.
9. In accordance with our Office’s Guidance on inappropriate data practices: interpretation and application of subsection 5(3)^{Footnote 2}, we consider the factors set out by the courts in order to assist in determining whether a reasonable person would find that an organization’s collection, use and disclosure of information is for an appropriate purpose in the circumstances. Specifically, in addition to considering the degree of sensitivity of the personal information at issue, we may consider:
   1. Whether the organization’s purpose represents a legitimate need / bona fide business interest;
   2. Whether the collection, use and disclosure would be effective in meeting the organization’s need;
   3. Whether there are less privacy invasive means of achieving the same ends at comparable cost and with comparable benefits; and
   4. Whether the loss of privacy is proportional to the benefits.

Sensitivity of the personal information collected via surveillance technology

10. The personal information collected by the respondent via surveillance technology included the conversations of employees that occurred within the cabs of their trucks while the key was in the ignition and the engine was running. These might have included private conversations with their relatives, friends, doctors or other third parties. Therefore, the OPC is of the view that the audio collected had the potential to be sensitive.

Legitimate need or bona fide business interest

11. The respondent represented that its purposes included logistics, safety, security, communication, and employee performance. More specifically, Oculus identified two primary objectives for the use of audio and video surveillance in the cabs:
    1. To aid incident investigations and liability apportionment; and
    2. To ensure legislative compliance with provincial regulations.
12. The respondent explained that it operates primarily in remote areas – for example, on forest service roads – and the vast majority of communication between drivers is conducted through 2-way radios. “Radio-controlled roads” are subject to both provincial regulations^{Footnote 3} and road owners’ policies. According to the respondent, failure to follow the requirements of a radio-controlled road – for example, the announcement (via two-way radio) of vehicle location at different marker points – can result in serious consequences, including accidents or no longer being allowed to use the road.
13. In light of the above, we accept that Oculus’s purposes represented a legitimate need.

Effectiveness

14. Oculus submitted that the use of audio and video surveillance was a significant aid in investigations as it allowed Oculus to demonstrate that proper rules and procedures were being followed.
15. The respondent provided various examples of past scenarios for which audio recordings, associated with visual records, could have been a valuable source of evidence. For instance, it would have given Oculus the ability to demonstrate the proper use of 2-way radios, to verify client instructions to the driver or to recreate a sequence of events associated with an accident, incident or complaint.
16. In the context of an accident, investigators could have used the recording to corroborate or challenge driver and witness accounts of what had occurred. This would have allowed Oculus to save both time and cost in the investigation process, and to properly apportion liability if necessary.
17. The respondent further represented that the use of audio and video surveillance could have allowed Oculus to demonstrate compliance with specific regulations and safety rules.
18. While we did not receive any specific examples of situations where the audio surveillance was actually used, we can see that it may have been effective in achieving Oculus’s underlying objectives.

Less privacy invasive means

19. Oculus explained that the device would record whenever the key was in the ignition and the truck was turned on, but was calibrated to overwrite information every 72 hours. The audio and video information was stored on an SD card. The device was physically locked. It could only be accessed and reviewed by authorized employees, in specified circumstances, such as a complaint, an accident or an incident.
20. Oculus represented that they explored alternative methods to audio surveillance, but were unable to identify a less privacy-invasive method that would efficiently achieve its identified purposes. For example, they considered using video surveillance only, but given that their business is communication/radio driven, decided against this option. The company’s previous approach involved a system of manual check-ins that did not effectively address its needs in the event of emergency or accident investigations.
21. While the OPC accepts that audio recordings could be useful to the respondent in certain circumstances, in our view, it was unnecessary for audio to be recorded at all times while the truck was on. Considering truck drivers are often on the road and will spend time in their trucks while off-duty (for example, with the engine turned on for heat while sleeping overnight), we are of the view that audio recording should have been limited to on-duty work hours.
22. Furthermore, the respondent indicated that its primary need was to capture communications conducted via two-way radio, to help investigate incidents, determine liability and demonstrate compliance with legislation. We question, therefore, why Oculus could not have limited the audio recordings to two-way radio communications.

Proportionality

23. We recognize that audio recordings were safeguarded against unauthorized access, and were only to be accessed in limited identified circumstances. However, the recordings in question, when accessed, would have included up to 72 hours of audio. This is inevitably much more than would be required for the identified purposes, potentially including sensitive personal conversations while the driver was off-duty. This was, in our view, highly intrusive to the privacy of drivers and disproportionate to the potential benefits gained by the respondent.
24. Ultimately, in our view, a reasonable person would not consider appropriate the purposes for which Oculus collected in-cab audio recordings of its drivers. We accept that the audio surveillance in question was in furtherance of a legitimate need, and that it may have been effective in achieving the respondent’s purposes. However, in our view, the collection of drivers’ potentially sensitive personal information, up to 24 hours a day, including when they were off-duty and even when they were sleeping, was more intrusive than necessary. The resulting impact on drivers’ privacy was disproportionate to any benefits the company may have gained from the surveillance.

Conclusion

25. Since the respondent informed our Office that it is no longer using audio surveillance, we consider the complaint to be well-founded and resolved.
26. Should Oculus decide to implement in-cab audio surveillance in future, we would expect that they limit the collection of audio to that which is necessary for the achievement of its purposes, taking into account the analysis and findings in this report.